Back to skill
Skillv1.0.0
ClawScan security
performance-profiler · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 11, 2026, 3:51 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only performance profiling guide whose required actions and recommendations align with its stated purpose; it does not request credentials or install code itself, but several recommended steps (debug endpoints, heap snapshots, open pprof ports, load tests) carry operational risks if misused.
- Guidance
- This is a legitimate profiling cookbook. Before you use it: (1) Never expose debug endpoints (heap snapshot, /debug/pprof) publicly — protect them with authentication, network ACLs, or bind to localhost. (2) Heap snapshots and pprof data may contain sensitive memory (tokens, PII), so store and share them carefully and delete after use. (3) Run heavy profiling and load tests against staging or isolated environments to avoid impacting production. (4) Installing global tooling (npm -g, pip) is optional — prefer virtualenvs/containers. (5) Audit any code you paste from the guide before adding debug endpoints to your app. If you want a stricter check, provide the exact commands you plan to run and the environment (prod/staging) so potential hazards can be reviewed.
Review Dimensions
- Purpose & Capability
- okThe name/description (performance profiling) matches the content: Node.js/Python/Go profiling, flamegraphs, bundle analysis, DB EXPLAINs, and load testing. Nothing in the files asks for unrelated credentials, binaries, or system-wide access that would be inconsistent with profiling.
- Instruction Scope
- noteSKILL.md and references contain concrete instructions to add debug endpoints (/debug/heap-snapshot, pprof endpoints), run profilers, and run load tests. These are expected for profiling, but they can expose sensitive memory/state or administrative endpoints if not properly protected and can cause production impact if run against live traffic. The guidance sometimes reminds to 'protect with auth' or 'use staging', but enforcement is left to the operator.
- Install Mechanism
- okThis is an instruction-only skill with no install spec or code files. The docs suggest installing tools (clinic, py-spy, memory-profiler) via npm/pip, which is normal for profiling workflows and are executed by the user rather than installed by the skill itself.
- Credentials
- okNo environment variables, credentials, or config paths are required by the skill. The content references typical env usage (e.g., ANALYZE=true) and monitoring services, but does not request tokens or secrets — this is proportionate to its purpose.
- Persistence & Privilege
- okThe skill does not request persistent presence, does not modify other skills, and is not always-enabled. It’s a passive instruction set the agent can follow when invoked.